Windows Process Creation: SharpSuccessor.exe Execution for Privilege Escalation

Alerts on SharpSuccessor.exe command-line patterns indicative of Windows privilege escalation attempts.

FreeUnreviewedSigmahighv1

windows-process-creation-sharpsuccessor-exe-execution-for-privilege-escalation-38a1ac5f

title: "Windows Process Creation: SharpSuccessor.exe Execution for Privilege Escalation"
id: 35d01d4e-db7a-4767-aa23-05b0a8744202
status: experimental
description: This rule flags execution of SharpSuccessor on Windows by matching the SharpSuccessor.exe process filename and command-line usage. The tool is commonly associated with privilege escalation attempts, where incorrect identity handling can be leveraged to gain elevated domain privileges. Telemetry required includes process creation events with the executable path, original file name, and full command line.
references:
  - https://github.com/logangoins/SharpSuccessor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpsuccessor_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-06
tags:
  - attack.privilege-escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SharpSuccessor.exe
    - OriginalFileName: SharpSuccessor.exe
    - CommandLine|contains: SharpSuccessor
    - CommandLine|contains|all:
        - " add "
        - " /impersonate"
        - " /path"
        - " /account"
        - " /name"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8
    type: derived

What it detects

This rule flags execution of SharpSuccessor on Windows by matching the SharpSuccessor.exe process filename and command-line usage. The tool is commonly associated with privilege escalation attempts, where incorrect identity handling can be leveraged to gain elevated domain privileges. Telemetry required includes process creation events with the executable path, original file name, and full command line.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.